CVE-2024-38588: ftrace: Fix possible use-after-free issue in ftrace_location()
ftrace: Fix possible use-after-free issue in ftracelocation()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.94-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.8.12-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Configuration
In ftrace_location(), replace use of lookup_rec() with ftrace_location_range() to avoid a possible use-after-free in ftrace pages during module deletion.
Linux kernel ftrace/kprobe ftrace_location() implementation = Use ftrace_location_range() instead of lookup_rec() - Compensating control
Add/ensure RCU synchronization when freeing or accessing ftrace pages: call synchronize_rcu() before freeing any ftrace pages in ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem(), and hold the RCU lock while accessing ftrace pages in ftrace_location_range().
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38588?
CVE-2024-38588 is classified as a medium severity vulnerability due to its potential for exploitation through use-after-free issues.
How do I fix CVE-2024-38588?
To fix CVE-2024-38588, update your Linux kernel to version 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
Which Linux kernel versions are affected by CVE-2024-38588?
CVE-2024-38588 affects Linux kernel versions between 3.7 and 6.1.93, as well as versions from 6.2 to 6.6.33, 6.7 to 6.8.12, and 6.9 to 6.9.3.
How does CVE-2024-38588 impact system security?
CVE-2024-38588 can potentially allow local attackers to exploit use-after-free conditions, compromising system stability and security.
Is there a workaround for CVE-2024-38588?
There are no widely recommended workarounds for CVE-2024-38588; updating the kernel is the primary solution.